[Buildroot] [PATCH 0/4] utils/checkpackagelib: check CPE variables (branch yem/checkpkg-cpe)

[Buildroot] [PATCH 0/4] utils/checkpackagelib: check CPE variables (branch yem/checkpkg-cpe)

[Yann E. MORIN]

Hello All!

This series removes superfluous CPE variables that are set to their
default values, and eventually adds a check-package test that ensures
none crop in back in the future.

The first two patches are from Fabrice, from his initial attempt at such
a check. Thanks!

Regards,
Yann E. MORIN.


----------------------------------------------------------------
Fabrice Fontaine (2):
      package/containerd: drop CONTAINERD_CPE_ID_VENDOR
      package/libcurl: drop LIBCURL_CPE_ID_PRODUCT

Yann E. MORIN (2):
      package/v4l2loopback: drop _CPE_ID_VENDOR
      utils/checkpackagelib: add check for CPE variables set to defautl values

 package/containerd/containerd.mk     |  1 -
 package/libcurl/libcurl.mk           |  1 -
 package/v4l2loopback/v4l2loopback.mk |  1 -
 utils/checkpackagelib/lib_mk.py      | 59 ++++++++++++++++++++++++++++++++++++
 4 files changed, 59 insertions(+), 3 deletions(-)

--
.-----------------.--------------------.------------------.--------------------.
|  Yann E. MORIN  | Real-Time Embedded | /"\ ASCII RIBBON | Erics' conspiracy: |
| +33 662 376 056 | Software  Designer | \ / CAMPAIGN     |  ___               |
| +33 561 099 427 `------------.-------:  X  AGAINST      |  \e/  There is no  |
| http://ymorin.is-a-geek.org/ | _/*\_ | / \ HTML MAIL    |   v   conspiracy.  |
'------------------------------^-------^------------------^--------------------'
_______________________________________________
buildroot mailing list
buildroot@buildroot.org
https://lists.buildroot.org/mailman/listinfo/buildroot

[Buildroot] [PATCH 1/4] package/containerd: drop CONTAINERD_CPE_ID_VENDOR

[Yann E. MORIN]

From: Fabrice Fontaine <fontaine.fabrice@gmail.com>

Commit 35af2bb8011ea57642777acf5613afa244d325d7 set
CONTAINERD_CPE_ID_PRODUCT to containerd but this is not needed as
CONTAINERD_CPE_ID_PRODUCT will be set to the package name
(i.e. containerd) by default

Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
---
 package/containerd/containerd.mk | 1 -
 1 file changed, 1 deletion(-)

diff --git a/package/containerd/containerd.mk b/package/containerd/containerd.mk
index 61a8472ddd..d3ca102797 100644
--- a/package/containerd/containerd.mk
+++ b/package/containerd/containerd.mk
@@ -9,7 +9,6 @@ CONTAINERD_SITE = $(call github,containerd,containerd,v$(CONTAINERD_VERSION))
 CONTAINERD_LICENSE = Apache-2.0
 CONTAINERD_LICENSE_FILES = LICENSE
 CONTAINERD_CPE_ID_VENDOR = linuxfoundation
-CONTAINERD_CPE_ID_PRODUCT = containerd
 
 CONTAINERD_GOMOD = github.com/containerd/containerd
 
-- 
2.43.0

_______________________________________________
buildroot mailing list
buildroot@buildroot.org
https://lists.buildroot.org/mailman/listinfo/buildroot

Re: [Buildroot] [PATCH 1/4] package/containerd: drop CONTAINERD_CPE_ID_VENDOR

[Antoine Coutant]

[-- Attachment #1.1: Type: text/plain, Size: 1187 bytes --]


On 04/02/2024 16:22, Yann E. MORIN wrote:
> From: Fabrice Fontaine<fontaine.fabrice@gmail.com>
>
> Commit 35af2bb8011ea57642777acf5613afa244d325d7 set
> CONTAINERD_CPE_ID_PRODUCT to containerd but this is not needed as
> CONTAINERD_CPE_ID_PRODUCT will be set to the package name
> (i.e. containerd) by default
>
> Signed-off-by: Fabrice Fontaine<fontaine.fabrice@gmail.com>
> Signed-off-by: Yann E. MORIN<yann.morin.1998@free.fr>
> ---
>   package/containerd/containerd.mk | 1 -
>   1 file changed, 1 deletion(-)
>
> diff --git a/package/containerd/containerd.mk b/package/containerd/containerd.mk
> index 61a8472ddd..d3ca102797 100644
> --- a/package/containerd/containerd.mk
> +++ b/package/containerd/containerd.mk
> @@ -9,7 +9,6 @@ CONTAINERD_SITE = $(call github,containerd,containerd,v$(CONTAINERD_VERSION))
>   CONTAINERD_LICENSE = Apache-2.0
>   CONTAINERD_LICENSE_FILES = LICENSE
>   CONTAINERD_CPE_ID_VENDOR = linuxfoundation
> -CONTAINERD_CPE_ID_PRODUCT = containerd
>   
>   CONTAINERD_GOMOD = github.com/containerd/containerd
>   

Looks good to me.


Reviewed-by: Antoine Coutant <antoine.coutant@smile.fr> 
<mailto:antoine.coutant@smile.fr>


Regards,

Antoine Coutant.


[-- Attachment #1.2: Type: text/html, Size: 2211 bytes --]

[-- Attachment #2: Type: text/plain, Size: 150 bytes --]

_______________________________________________
buildroot mailing list
buildroot@buildroot.org
https://lists.buildroot.org/mailman/listinfo/buildroot

Re: [Buildroot] [PATCH 1/4] package/containerd: drop CONTAINERD_CPE_ID_VENDOR

[Yann E. MORIN]

Fabrice, All,

On 2024-02-04 16:22 +0100, Yann E. MORIN spake thusly:
> From: Fabrice Fontaine <fontaine.fabrice@gmail.com>
> 
> Commit 35af2bb8011ea57642777acf5613afa244d325d7 set
> CONTAINERD_CPE_ID_PRODUCT to containerd but this is not needed as
> CONTAINERD_CPE_ID_PRODUCT will be set to the package name
> (i.e. containerd) by default
> 
> Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
> Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>

Applied to master, thanks.

Regards,
Yann E. MORIN.

> ---
>  package/containerd/containerd.mk | 1 -
>  1 file changed, 1 deletion(-)
> 
> diff --git a/package/containerd/containerd.mk b/package/containerd/containerd.mk
> index 61a8472ddd..d3ca102797 100644
> --- a/package/containerd/containerd.mk
> +++ b/package/containerd/containerd.mk
> @@ -9,7 +9,6 @@ CONTAINERD_SITE = $(call github,containerd,containerd,v$(CONTAINERD_VERSION))
>  CONTAINERD_LICENSE = Apache-2.0
>  CONTAINERD_LICENSE_FILES = LICENSE
>  CONTAINERD_CPE_ID_VENDOR = linuxfoundation
> -CONTAINERD_CPE_ID_PRODUCT = containerd
>  
>  CONTAINERD_GOMOD = github.com/containerd/containerd
>  
> -- 
> 2.43.0
> 
> _______________________________________________
> buildroot mailing list
> buildroot@buildroot.org
> https://lists.buildroot.org/mailman/listinfo/buildroot

-- 
.-----------------.--------------------.------------------.--------------------.
|  Yann E. MORIN  | Real-Time Embedded | /"\ ASCII RIBBON | Erics' conspiracy: |
| +33 662 376 056 | Software  Designer | \ / CAMPAIGN     |  ___               |
| +33 561 099 427 `------------.-------:  X  AGAINST      |  \e/  There is no  |
| http://ymorin.is-a-geek.org/ | _/*\_ | / \ HTML MAIL    |   v   conspiracy.  |
'------------------------------^-------^------------------^--------------------'
_______________________________________________
buildroot mailing list
buildroot@buildroot.org
https://lists.buildroot.org/mailman/listinfo/buildroot

[Buildroot] [PATCH 2/4] package/libcurl: drop LIBCURL_CPE_ID_PRODUCT

[Yann E. MORIN]

From: Fabrice Fontaine <fontaine.fabrice@gmail.com>

Commit 4b6202f721f2f5ab36153ba44de65286f7811ef9 set
LIBCURL_CPE_ID_PRODUCT to libcurl but this is not needed as
LIBCURL_CPE_ID_PRODUCT will be set to the package name
(i.e. libcurl) by default

Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
---
 package/libcurl/libcurl.mk | 1 -
 1 file changed, 1 deletion(-)

diff --git a/package/libcurl/libcurl.mk b/package/libcurl/libcurl.mk
index 3ecc587a52..83845b8e87 100644
--- a/package/libcurl/libcurl.mk
+++ b/package/libcurl/libcurl.mk
@@ -13,7 +13,6 @@ LIBCURL_DEPENDENCIES = host-pkgconf \
 LIBCURL_LICENSE = curl
 LIBCURL_LICENSE_FILES = COPYING
 LIBCURL_CPE_ID_VENDOR = haxx
-LIBCURL_CPE_ID_PRODUCT = libcurl
 LIBCURL_INSTALL_STAGING = YES
 
 # We disable NTLM delegation to winbinds ntlm_auth ('--disable-ntlm-wb')
-- 
2.43.0

_______________________________________________
buildroot mailing list
buildroot@buildroot.org
https://lists.buildroot.org/mailman/listinfo/buildroot

Re: [Buildroot] [PATCH 2/4] package/libcurl: drop LIBCURL_CPE_ID_PRODUCT

[Antoine Coutant]

[-- Attachment #1.1: Type: text/plain, Size: 1124 bytes --]


On 04/02/2024 16:22, Yann E. MORIN wrote:
> From: Fabrice Fontaine<fontaine.fabrice@gmail.com>
>
> Commit 4b6202f721f2f5ab36153ba44de65286f7811ef9 set
> LIBCURL_CPE_ID_PRODUCT to libcurl but this is not needed as
> LIBCURL_CPE_ID_PRODUCT will be set to the package name
> (i.e. libcurl) by default
>
> Signed-off-by: Fabrice Fontaine<fontaine.fabrice@gmail.com>
> Signed-off-by: Yann E. MORIN<yann.morin.1998@free.fr>
> ---
>   package/libcurl/libcurl.mk | 1 -
>   1 file changed, 1 deletion(-)
>
> diff --git a/package/libcurl/libcurl.mk b/package/libcurl/libcurl.mk
> index 3ecc587a52..83845b8e87 100644
> --- a/package/libcurl/libcurl.mk
> +++ b/package/libcurl/libcurl.mk
> @@ -13,7 +13,6 @@ LIBCURL_DEPENDENCIES = host-pkgconf \
>   LIBCURL_LICENSE = curl
>   LIBCURL_LICENSE_FILES = COPYING
>   LIBCURL_CPE_ID_VENDOR = haxx
> -LIBCURL_CPE_ID_PRODUCT = libcurl
>   LIBCURL_INSTALL_STAGING = YES
>   
>   # We disable NTLM delegation to winbinds ntlm_auth ('--disable-ntlm-wb')

Looks good to me.


Reviewed-by: Antoine Coutant <antoine.coutant@smile.fr> 
<mailto:antoine.coutant@smile.fr>


Regards,

Antoine Coutant.

[-- Attachment #1.2: Type: text/html, Size: 2128 bytes --]

[-- Attachment #2: Type: text/plain, Size: 150 bytes --]

_______________________________________________
buildroot mailing list
buildroot@buildroot.org
https://lists.buildroot.org/mailman/listinfo/buildroot

Re: [Buildroot] [PATCH 2/4] package/libcurl: drop LIBCURL_CPE_ID_PRODUCT

[Yann E. MORIN]

Fabrice, All,

On 2024-02-04 16:22 +0100, Yann E. MORIN spake thusly:
> From: Fabrice Fontaine <fontaine.fabrice@gmail.com>
> 
> Commit 4b6202f721f2f5ab36153ba44de65286f7811ef9 set
> LIBCURL_CPE_ID_PRODUCT to libcurl but this is not needed as
> LIBCURL_CPE_ID_PRODUCT will be set to the package name
> (i.e. libcurl) by default
> 
> Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
> Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>

Applied to master, thanks.

Regards,
Yann E. MORIN.

> ---
>  package/libcurl/libcurl.mk | 1 -
>  1 file changed, 1 deletion(-)
> 
> diff --git a/package/libcurl/libcurl.mk b/package/libcurl/libcurl.mk
> index 3ecc587a52..83845b8e87 100644
> --- a/package/libcurl/libcurl.mk
> +++ b/package/libcurl/libcurl.mk
> @@ -13,7 +13,6 @@ LIBCURL_DEPENDENCIES = host-pkgconf \
>  LIBCURL_LICENSE = curl
>  LIBCURL_LICENSE_FILES = COPYING
>  LIBCURL_CPE_ID_VENDOR = haxx
> -LIBCURL_CPE_ID_PRODUCT = libcurl
>  LIBCURL_INSTALL_STAGING = YES
>  
>  # We disable NTLM delegation to winbinds ntlm_auth ('--disable-ntlm-wb')
> -- 
> 2.43.0
> 
> _______________________________________________
> buildroot mailing list
> buildroot@buildroot.org
> https://lists.buildroot.org/mailman/listinfo/buildroot

-- 
.-----------------.--------------------.------------------.--------------------.
|  Yann E. MORIN  | Real-Time Embedded | /"\ ASCII RIBBON | Erics' conspiracy: |
| +33 662 376 056 | Software  Designer | \ / CAMPAIGN     |  ___               |
| +33 561 099 427 `------------.-------:  X  AGAINST      |  \e/  There is no  |
| http://ymorin.is-a-geek.org/ | _/*\_ | / \ HTML MAIL    |   v   conspiracy.  |
'------------------------------^-------^------------------^--------------------'
_______________________________________________
buildroot mailing list
buildroot@buildroot.org
https://lists.buildroot.org/mailman/listinfo/buildroot

[Buildroot] [PATCH 3/4] package/v4l2loopback: drop _CPE_ID_VENDOR

[Yann E. MORIN]

Commit 1edb9d691dec (package/v4l2loopback: add
V4L2LOOPBACK_CPE_ID_VENDOR) added that variable, but set to its default
value.

This is however not required to define a valid CPE ID, as it also
defines a non-default CPE_ID_PREFIX.

Drop V4L2LOOPBACK_CPE_ID_VENDOR now.

Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
Cc: Fabrice Fontaine <fontaine.fabrice@gmail.com>
---
 package/v4l2loopback/v4l2loopback.mk | 1 -
 1 file changed, 1 deletion(-)

diff --git a/package/v4l2loopback/v4l2loopback.mk b/package/v4l2loopback/v4l2loopback.mk
index 84e1927ce3..50a168fcab 100644
--- a/package/v4l2loopback/v4l2loopback.mk
+++ b/package/v4l2loopback/v4l2loopback.mk
@@ -8,7 +8,6 @@ V4L2LOOPBACK_VERSION = 0.12.7
 V4L2LOOPBACK_SITE = $(call github,umlaeute,v4l2loopback,v$(V4L2LOOPBACK_VERSION))
 V4L2LOOPBACK_LICENSE = GPL-2.0+
 V4L2LOOPBACK_LICENSE_FILES = COPYING
-V4L2LOOPBACK_CPE_ID_VENDOR = v4l2loopback_project
 V4L2LOOPBACK_CPE_ID_PREFIX = cpe:2.3:o
 
 ifeq ($(BR2_PACKAGE_V4L2LOOPBACK_UTILS),y)
-- 
2.43.0

_______________________________________________
buildroot mailing list
buildroot@buildroot.org
https://lists.buildroot.org/mailman/listinfo/buildroot

Re: [Buildroot] [PATCH 3/4] package/v4l2loopback: drop _CPE_ID_VENDOR

[Peter Korsgaard]

On 04/02/2024 16.22, Yann E. MORIN wrote:
> Commit 1edb9d691dec (package/v4l2loopback: add
> V4L2LOOPBACK_CPE_ID_VENDOR) added that variable, but set to its default
> value.
> 
> This is however not required to define a valid CPE ID, as it also
> defines a non-default CPE_ID_PREFIX.
> 
> Drop V4L2LOOPBACK_CPE_ID_VENDOR now.
> 
> Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
> Cc: Fabrice Fontaine <fontaine.fabrice@gmail.com>

Committed, thanks.

-- 
Bye, Peter Korsgaard

_______________________________________________
buildroot mailing list
buildroot@buildroot.org
https://lists.buildroot.org/mailman/listinfo/buildroot

[Buildroot] [PATCH 4/4] utils/checkpackagelib: add check for CPE variables set to defautl values

[Yann E. MORIN]

The way we handle CPE variable is unsual compared to the other
variables: we mostly compute defaults for all of them, and eventually
aggregate the various CPE variables to form the CPE ID name.

However, we do not consider that CPE ID to valid, unless there is one
(or more) CPE variables actually set by thje package. This shows that
the CPE ID has been checked to be valid against the NVD CPE database.

However, it is totally possible (and very often the case) that the
default value we set to those variables are appropriate, and do defne a
valid CPE ID. In this case, the package will define any arbitrary cPE
variable to tis default value, usually by setting either the VENDOR or
PRODUCT field, though there is no rule or requirement that be the case.

But since we only need one variable to be set, if they all are set to
their default value, or one is set to a non-default value, there is no
need to define the others to their default value.

So, the rules are really:

  * no valid CPE ID known: define no CPE variable;

  * valid CPE ID known, using all defaults fields: set a single CPE
    variable;

  * valid CPE ID known, at least one CPE field id non default: only set
    those CPE variables that are not default.

So, we add a new check to checkpakcagelib, that ensures the above rules
are met: if a CPE variable is set to its default, then it should be the
only CPE variable set at all.

Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
Cc: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Cc: Ricardo Martincoski <ricardo.martincoski@gmail.com>
---
 utils/checkpackagelib/lib_mk.py | 59 +++++++++++++++++++++++++++++++++
 1 file changed, 59 insertions(+)

diff --git a/utils/checkpackagelib/lib_mk.py b/utils/checkpackagelib/lib_mk.py
index d340882971..1eb20fc04a 100644
--- a/utils/checkpackagelib/lib_mk.py
+++ b/utils/checkpackagelib/lib_mk.py
@@ -366,3 +366,62 @@ class VariableWithBraces(_CheckFunction):
             return ["{}:{}: use $() to delimit variables, not ${{}}"
                     .format(self.filename, lineno),
                     text]
+
+
+class CPEProduct(_CheckFunction):
+    """
+    Check that the values for the CPE variables are not the default.
+    However, if there is only one such variable set, the default
+    is acceptable, because that is used to set whether the CPE info
+    is valid or not.
+    """
+    def before(self):
+        pkg, _ = os.path.splitext(os.path.basename(self.filename))
+        self.CPE_fields = {
+            "PREFIX": "cpe:2.3:a",
+            "VENDOR": f"{pkg}_project",
+            "PRODUCT": pkg,
+            "VERSION": None,
+            "UPDATE": "*",
+        }
+        self.VAR_SPLIT_RE = re.compile(
+            r"^.+_CPE_ID_({})\s*=\s*(.+)$"
+            .format("|".join(self.CPE_fields)),
+        )
+        self.nb_CPE_fields = 0
+        self.CPE_info = dict()
+        self.VERSION_RE = re.compile(
+            r"^.*_VERSION\s*=\*(.+)$",
+        )
+
+    def check_line(self, lineno, text):
+        match = self.VERSION_RE.match(text)
+        if match:
+            self.CPE_fields["VERSION"] = match.groups()[0]
+
+        match = self.VAR_SPLIT_RE.match(text)
+        if match:
+            self.nb_CPE_fields += 1
+            CPE_f, CPE_v = match.groups()
+            self.CPE_info[CPE_f] = {
+                "lineno": lineno,
+                "text": text,
+                "val": CPE_v,
+            }
+
+    def after(self):
+        if self.nb_CPE_fields <= 1:
+            return
+        defaults = list()
+        for f in self.CPE_fields:
+            if f not in self.CPE_info:
+                continue
+            lineno = self.CPE_info[f]["lineno"]
+            text = self.CPE_info[f]["text"]
+            val = self.CPE_info[f]["val"]
+            if val == self.CPE_fields[f]:
+                defaults.append(
+                    f"{self.filename}:{lineno}: {val} is the default value: {text}"
+                )
+
+        return defaults or None
-- 
2.43.0

_______________________________________________
buildroot mailing list
buildroot@buildroot.org
https://lists.buildroot.org/mailman/listinfo/buildroot